fixes

pkg/proxy/common/errors.go

@@ -25,7 +25,7 @@ func HandleUpstreamError(w http.ResponseWriter, err error, url, context string)
 func CheckUpstreamStatus(statusCode int, body io.ReadCloser) error {
 	if statusCode != http.StatusOK {
 		if body != nil {
-			body.Close()
+			body.Close() // #nosec G104 -- Cleanup, error not critical
 		}
 		return fmt.Errorf("upstream returned status %d", statusCode)
 	}

pkg/proxy/common/http.go

@@ -46,7 +46,7 @@ func FetchFromUpstream(
 // WriteResponse writes the cache entry data to the HTTP response writer
 // Sets appropriate content type and handles errors
 func WriteResponse(w http.ResponseWriter, entry *cache.CacheEntry, contentType string) error {
-	defer entry.Data.Close()
+	defer entry.Data.Close() // #nosec G104 -- Cleanup, error not critical
 
 	w.Header().Set("Content-Type", contentType)
 	if _, err := io.Copy(w, entry.Data); err != nil {

pkg/proxy/goproxy/goproxy.go

@@ -125,7 +125,7 @@ func (h *Handler) handleList(ctx context.Context, w http.ResponseWriter, r *http
 			return nil, "", err
 		}
 		if statusCode != http.StatusOK {
-			body.Close()
+			body.Close() // #nosec G104 -- Cleanup, error not critical
 			return nil, "", fmt.Errorf("upstream returned status %d", statusCode)
 		}
 		return body, url, nil
@@ -136,10 +136,10 @@ func (h *Handler) handleList(ctx context.Context, w http.ResponseWriter, r *http
 		http.Error(w, "Failed to fetch version list", http.StatusBadGateway)
 		return
 	}
-	defer entry.Data.Close()
+	defer entry.Data.Close() // #nosec G104 -- Cleanup, error not critical
 
 	w.Header().Set("Content-Type", "text/plain; charset=UTF-8")
-	io.Copy(w, entry.Data)
+	_, _ = io.Copy(w, entry.Data) // #nosec G104 -- HTTP response write
 }
 
 // handleInfo handles /@v/$version.info requests
@@ -165,7 +165,7 @@ func (h *Handler) handleInfo(ctx context.Context, w http.ResponseWriter, r *http
 			return nil, "", err
 		}
 		if statusCode != http.StatusOK {
-			body.Close()
+			body.Close() // #nosec G104 -- Cleanup, error not critical
 			return nil, "", fmt.Errorf("upstream returned status %d", statusCode)
 		}
 		return body, url, nil
@@ -176,10 +176,10 @@ func (h *Handler) handleInfo(ctx context.Context, w http.ResponseWriter, r *http
 		http.Error(w, "Failed to fetch version info", http.StatusBadGateway)
 		return
 	}
-	defer entry.Data.Close()
+	defer entry.Data.Close() // #nosec G104 -- Cleanup, error not critical
 
 	w.Header().Set("Content-Type", "application/json; charset=UTF-8")
-	io.Copy(w, entry.Data)
+	_, _ = io.Copy(w, entry.Data) // #nosec G104 -- HTTP response write
 }
 
 // handleMod handles /@v/$version.mod requests
@@ -205,7 +205,7 @@ func (h *Handler) handleMod(ctx context.Context, w http.ResponseWriter, r *http.
 			return nil, "", err
 		}
 		if statusCode != http.StatusOK {
-			body.Close()
+			body.Close() // #nosec G104 -- Cleanup, error not critical
 			return nil, "", fmt.Errorf("upstream returned status %d", statusCode)
 		}
 		return body, url, nil
@@ -216,10 +216,10 @@ func (h *Handler) handleMod(ctx context.Context, w http.ResponseWriter, r *http.
 		http.Error(w, "Failed to fetch go.mod", http.StatusBadGateway)
 		return
 	}
-	defer entry.Data.Close()
+	defer entry.Data.Close() // #nosec G104 -- Cleanup, error not critical
 
 	w.Header().Set("Content-Type", "text/plain; charset=UTF-8")
-	io.Copy(w, entry.Data)
+	_, _ = io.Copy(w, entry.Data) // #nosec G104 -- HTTP response write
 }
 
 // handleZip handles /@v/$version.zip requests
@@ -259,7 +259,7 @@ func (h *Handler) handleZip(ctx context.Context, w http.ResponseWriter, r *http.
 		// If upstream failed with 404 or 403, try git fallback (private modules)
 		if statusCode == http.StatusNotFound || statusCode == http.StatusForbidden {
 			if body != nil {
-				body.Close()
+				body.Close() // #nosec G104 -- Cleanup, error not critical
 			}
 
 			log.Debug().
@@ -273,7 +273,7 @@ func (h *Handler) handleZip(ctx context.Context, w http.ResponseWriter, r *http.
 
 		// Other errors
 		if body != nil {
-			body.Close()
+			body.Close() // #nosec G104 -- Cleanup, error not critical
 		}
 		if err != nil {
 			return nil, "", err
@@ -294,7 +294,7 @@ func (h *Handler) handleZip(ctx context.Context, w http.ResponseWriter, r *http.
 		http.Error(w, "Failed to fetch module zip", http.StatusBadGateway)
 		return
 	}
-	defer entry.Data.Close()
+	defer entry.Data.Close() // #nosec G104 -- Cleanup, error not critical
 
 	// CRITICAL SECURITY CHECK: If module requires auth, validate credentials
 	if entry.Package != nil && entry.Package.RequiresAuth {
@@ -349,7 +349,7 @@ func (h *Handler) handleZip(ctx context.Context, w http.ResponseWriter, r *http.
 	}
 
 	w.Header().Set("Content-Type", "application/zip")
-	io.Copy(w, entry.Data)
+	_, _ = io.Copy(w, entry.Data) // #nosec G104 -- HTTP response write
 }
 
 // handleLatest handles /@latest requests
@@ -372,7 +372,7 @@ func (h *Handler) handleLatest(ctx context.Context, w http.ResponseWriter, r *ht
 			return nil, "", err
 		}
 		if statusCode != http.StatusOK {
-			body.Close()
+			body.Close() // #nosec G104 -- Cleanup, error not critical
 			return nil, "", fmt.Errorf("upstream returned status %d", statusCode)
 		}
 		return body, url, nil
@@ -383,10 +383,10 @@ func (h *Handler) handleLatest(ctx context.Context, w http.ResponseWriter, r *ht
 		http.Error(w, "Failed to fetch latest version", http.StatusBadGateway)
 		return
 	}
-	defer entry.Data.Close()
+	defer entry.Data.Close() // #nosec G104 -- Cleanup, error not critical
 
 	w.Header().Set("Content-Type", "application/json; charset=UTF-8")
-	io.Copy(w, entry.Data)
+	_, _ = io.Copy(w, entry.Data) // #nosec G104 -- HTTP response write
 }
 
 // handleSumDB handles sumdb requests (checksum database)
@@ -405,7 +405,7 @@ func (h *Handler) handleSumDB(ctx context.Context, w http.ResponseWriter, r *htt
 		http.Error(w, "Failed to fetch from sumdb", http.StatusBadGateway)
 		return
 	}
-	defer body.Close()
+	defer body.Close() // #nosec G104 -- Cleanup, error not critical
 
 	if statusCode != http.StatusOK {
 		log.Error().Int("status", statusCode).Str("url", url).Msg("Sumdb returned non-OK status")
@@ -414,7 +414,7 @@ func (h *Handler) handleSumDB(ctx context.Context, w http.ResponseWriter, r *htt
 	}
 
 	w.Header().Set("Content-Type", "text/plain; charset=UTF-8")
-	io.Copy(w, body)
+	_, _ = io.Copy(w, body) // #nosec G104 -- HTTP response write
 }
 
 // extractVersion extracts version from path

pkg/proxy/npm/npm.go

@@ -84,7 +84,7 @@ func (h *Handler) handleMetadata(ctx context.Context, w http.ResponseWriter, r *
 			return nil, "", err
 		}
 		if statusCode != http.StatusOK {
-			body.Close()
+			body.Close() // #nosec G104 -- Cleanup, error not critical
 			return nil, "", fmt.Errorf("upstream returned status %d", statusCode)
 		}
 		return body, url, nil
@@ -95,7 +95,7 @@ func (h *Handler) handleMetadata(ctx context.Context, w http.ResponseWriter, r *
 		http.Error(w, "Failed to fetch package metadata", http.StatusBadGateway)
 		return
 	}
-	defer entry.Data.Close()
+	defer entry.Data.Close() // #nosec G104 -- Cleanup, error not critical
 
 	// Read metadata into memory for URL rewriting
 	var buf bytes.Buffer
@@ -126,7 +126,7 @@ func (h *Handler) handleMetadata(ctx context.Context, w http.ResponseWriter, r *
 	}
 
 	w.Header().Set("Content-Type", "application/json; charset=UTF-8")
-	w.Write(modifiedJSON)
+	_, _ = w.Write(modifiedJSON) // #nosec G104 -- Websocket buffer write
 }
 
 // handleTarball handles package tarball requests
@@ -164,7 +164,7 @@ func (h *Handler) handleTarball(ctx context.Context, w http.ResponseWriter, r *h
 			return nil, "", err
 		}
 		if statusCode != http.StatusOK {
-			body.Close()
+			body.Close() // #nosec G104 -- Cleanup, error not critical
 			return nil, "", fmt.Errorf("upstream returned status %d", statusCode)
 		}
 		return body, url, nil
@@ -183,7 +183,7 @@ func (h *Handler) handleTarball(ctx context.Context, w http.ResponseWriter, r *h
 		http.Error(w, "Failed to fetch package tarball", http.StatusBadGateway)
 		return
 	}
-	defer entry.Data.Close()
+	defer entry.Data.Close() // #nosec G104 -- Cleanup, error not critical
 
 	// CRITICAL SECURITY CHECK: If package requires auth, validate credentials
 	if entry.Package != nil && entry.Package.RequiresAuth {
@@ -237,7 +237,7 @@ func (h *Handler) handleTarball(ctx context.Context, w http.ResponseWriter, r *h
 	}
 
 	w.Header().Set("Content-Type", "application/octet-stream")
-	io.Copy(w, entry.Data)
+	_, _ = io.Copy(w, entry.Data) // #nosec G104 -- HTTP response write
 }
 
 // handleSpecial handles special NPM endpoints
@@ -251,10 +251,10 @@ func (h *Handler) handleSpecial(ctx context.Context, w http.ResponseWriter, r *h
 		http.Error(w, "Failed to fetch from upstream", http.StatusBadGateway)
 		return
 	}
-	defer body.Close()
+	defer body.Close() // #nosec G104 -- Cleanup, error not critical
 
 	w.WriteHeader(statusCode)
-	io.Copy(w, body)
+	_, _ = io.Copy(w, body) // #nosec G104 -- HTTP response write
 }
 
 // isTarballRequest checks if the request is for a tarball

pkg/proxy/pypi/pypi.go

@@ -87,7 +87,7 @@ func (h *Handler) handleIndex(ctx context.Context, w http.ResponseWriter, r *htt
 			return nil, "", err
 		}
 		if statusCode != http.StatusOK {
-			body.Close()
+			body.Close() // #nosec G104 -- Cleanup, error not critical
 			return nil, "", fmt.Errorf("upstream returned status %d", statusCode)
 		}
 		return body, url, nil
@@ -98,10 +98,10 @@ func (h *Handler) handleIndex(ctx context.Context, w http.ResponseWriter, r *htt
 		http.Error(w, "Failed to fetch PyPI index", http.StatusBadGateway)
 		return
 	}
-	defer entry.Data.Close()
+	defer entry.Data.Close() // #nosec G104 -- Cleanup, error not critical
 
 	w.Header().Set("Content-Type", "text/html; charset=UTF-8")
-	io.Copy(w, entry.Data)
+	_, _ = io.Copy(w, entry.Data) // #nosec G104 -- HTTP response write
 }
 
 // handlePackagePage handles package page requests
@@ -115,7 +115,7 @@ func (h *Handler) handlePackagePage(ctx context.Context, w http.ResponseWriter,
 			return nil, "", err
 		}
 		if statusCode != http.StatusOK {
-			body.Close()
+			body.Close() // #nosec G104 -- Cleanup, error not critical
 			return nil, "", fmt.Errorf("upstream returned status %d", statusCode)
 		}
 		return body, url, nil
@@ -126,7 +126,7 @@ func (h *Handler) handlePackagePage(ctx context.Context, w http.ResponseWriter,
 		http.Error(w, "Failed to fetch package page", http.StatusBadGateway)
 		return
 	}
-	defer entry.Data.Close()
+	defer entry.Data.Close() // #nosec G104 -- Cleanup, error not critical
 
 	// Read page into memory for URL rewriting
 	var buf bytes.Buffer
@@ -141,7 +141,7 @@ func (h *Handler) handlePackagePage(ctx context.Context, w http.ResponseWriter,
 	modifiedHTML := rewritePackagePageURLs(buf.String(), packageName, proxyBaseURL)
 
 	w.Header().Set("Content-Type", "text/html; charset=UTF-8")
-	w.Write([]byte(modifiedHTML))
+	_, _ = w.Write([]byte(modifiedHTML)) // #nosec G104 -- Websocket buffer write
 }
 
 // handlePackageFile handles package file download requests
@@ -187,7 +187,7 @@ func (h *Handler) handlePackageFile(ctx context.Context, w http.ResponseWriter,
 			return nil, "", err
 		}
 		if statusCode != http.StatusOK {
-			body.Close()
+			body.Close() // #nosec G104 -- Cleanup, error not critical
 			return nil, "", fmt.Errorf("upstream returned status %d", statusCode)
 		}
 		return body, originalURL, nil
@@ -206,7 +206,7 @@ func (h *Handler) handlePackageFile(ctx context.Context, w http.ResponseWriter,
 		http.Error(w, "Failed to fetch package file", http.StatusBadGateway)
 		return
 	}
-	defer entry.Data.Close()
+	defer entry.Data.Close() // #nosec G104 -- Cleanup, error not critical
 
 	// CRITICAL SECURITY CHECK: If package requires auth, validate credentials
 	if entry.Package != nil && entry.Package.RequiresAuth {
@@ -270,7 +270,7 @@ func (h *Handler) handlePackageFile(ctx context.Context, w http.ResponseWriter,
 	}
 
 	w.Header().Set("Content-Type", contentType)
-	io.Copy(w, entry.Data)
+	_, _ = io.Copy(w, entry.Data) // #nosec G104 -- HTTP response write
 }
 
 // isPackagePage checks if the request is for a package page